CVE-2026-17457: Information Disclosure in mf-yang openclaw-cn
Affects mf-yang openclaw-cnSource CVE Database V5
Not known to be exploited · CVSS 5.3 Medium : update mf-yang openclaw-cn when convenient.
Data as of 10/24/2026, 17:08:24 UTC
- Exploitation
Not in CISA KEV, no exploitation reported
- EPSS
- 0.4% chance of exploitation in 30 days – higher than 35% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:PWhat to do
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| mf-yangopenclaw-cn | Affected
| Fixed in– |
GitHub Actionsmf-yang/openclaw-cnpkg:github/mf-yang/openclaw-cnOther threats | Affected
| Fixed in– |
CPE configurations (1)
cpe:2.3:a:mf-yang:openclaw-cn:*:*:*:*:*:*:*:*
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
AI-suggested
Since the project has not responded with a fix, users should monitor for official updates or consider implementing temporary mitigations such as restricting or validating input URLs before they reach the vulnerable function.
Description
CVE-2026-17457 is an information disclosure vulnerability in the mf-yang openclaw-cn project affecting versions 0.2.0 and 0.2.1. The issue exists in the assertBrowserNavigationAllowed function within the src/browser/navigation-guard.ts file of the Scheme Handler component. Manipulating the url argument can lead to unintended information disclosure. The vulnerability can be exploited remotely without user interaction. The project has been informed but has not issued a response or fix. The CVSS 4.0 base score is 5.3, indicating medium severity.
Impact
Successful exploitation of this vulnerability can lead to unauthorized disclosure of information due to improper validation or handling of navigation URLs. This could expose sensitive data to remote attackers without requiring user interaction or elevated privileges. The impact is limited to information disclosure with low confidentiality impact as per the CVSS vector.
Summary
This vulnerability in mf-yang openclaw-cn up to version 0.2.1 involves improper handling of the url argument in the assertBrowserNavigationAllowed function of the Scheme Handler component. This flaw allows an attacker to remotely cause information disclosure by manipulating the url parameter. The vulnerability has been publicly disclosed, and while the project was notified early, no official remediation or patch has been released. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, and low impact on confidentiality.